{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2026-013.pdf"
    },
    "title": "Critical Vulnerability in F5 BIG-IP APM",
    "serial_number": "2026-013",
    "publish_date": "22-09-2026 16:52:36",
    "description": "On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild.<br>\nCERT-EU recommends taking appropriate actions as soon as possible.<br>\n",
    "url_title": "2026-013",
    "content_markdown": "---    \ntitle: 'Critical Vulnerability in\u00a0F5\u00a0BIG-IP\u00a0APM'\nnumber: '2026-013'\nversion: '1.0'\noriginal_date: '2026-09-22'\ndate: '2026-09-22'\n---\n\n_History:_\n\n* _22/09/2026 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor **confirmed active exploitation in the wild** [1].\n\nCERT-EU recommends taking appropriate actions as soon as possible.\n\n\n# Technical Details\n\nThe vulnerability **CVE-2026-94127**, with a CVSS score of 9.8, is a **heap-based buffer overflow vulnerability** and allow **unauthenticated** attacker to achieve **remote code execution** (RCE) on the affected device [1].\n\n# Affected Products\n\nThe vulnerability affects the following versions of BIG-IP APM **if** configured with an access policy and an OAuth profile on a virtual server [1]:\n\n- 17.1.0 - 17.1.3\n- 17.5.0 - 17.5.1\n- 21.1.0\n\n# Recommendations\n\nCERT-EU recommends taking the following actions as soon as possible:\n\n1. Preserve forensic evidence.\n2. Apply the relevant hotfix.\n3. Check for signs of compromise (see the compromise assessment section). If any sign of compromise is detected, start the incident response process.\n\n## Mitigation\n\nIf patching cannot be applied immediately, F5 provides an iRule-based mitigation for the affected virtual server. To obtain it, F5 BIG-IP clients should contact the F5 support [1].\n\n## Compromise Assessment\n\nCERT-EU strongly advises to look for the following indicators of compromise provided by the vendor in its advisory [1]:\n\nAt a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system.\n\n1. OAuth authentication failures: check `/var/log/apm` for repeated occurrences of the following, especially 10 or more from a single IP in a short window.\n\n```\n<DATE> <HOST> err tmm1\\[30975\\]: 01990004:3: <PROFILE\\_NAME>: Request UserInfo from Source ID (null) IP <IP> failed. Error Code (invalid\\_token) Error Description (The access token is invalid.)\n```\n\n2. Increase of OAuth failure statistics. Run the following and look for an unexplained increase in `total_failed`:\n\n```\n$ tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed\n```\n\n3. Audit log anomalies: if OAuth failures are observed, review `/var/log/audit` around those timestamps for suspicious commands.\n\n4. TMM core files: Presence of a TMM core file alone is not an indicator, but core files should be investigated. The vendor indicates that they have observed TMM entering a loop, which causes the SOD daemon to send a SIGABRT.\n\n# References\n\n[1] <https://my.f5.com/manage/s/article/K000162605?mkt_tok=NjUzLVNNQy03ODMAAAGkaH9ofwJ_SRrYgVTlugDrbGmtsu1nH57-t7CLkyTTdZHlyphUFNtULl3ACEteoRszBciQ_4gjkNsWTnQqQfftwYMNCzWPXxGhUqTJ-emmdyUmrf_dqfI> \n",
    "content_html": "<p><em>History:</em></p><ul><li><em>22/09/2026 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor <strong>confirmed active exploitation in the wild</strong> [1].</p><p>CERT-EU recommends taking appropriate actions as soon as possible.</p><h2 id=\"technical-details\">Technical Details</h2><p>The vulnerability <strong>CVE-2026-94127</strong>, with a CVSS score of 9.8, is a <strong>heap-based buffer overflow vulnerability</strong> and allow <strong>unauthenticated</strong> attacker to achieve <strong>remote code execution</strong> (RCE) on the affected device [1].</p><h2 id=\"affected-products\">Affected Products</h2><p>The vulnerability affects the following versions of BIG-IP APM <strong>if</strong> configured with an access policy and an OAuth profile on a virtual server [1]:</p><ul><li>17.1.0 - 17.1.3</li><li>17.5.0 - 17.5.1</li><li>21.1.0</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU recommends taking the following actions as soon as possible:</p><ol><li>Preserve forensic evidence.</li><li>Apply the relevant hotfix.</li><li>Check for signs of compromise (see the compromise assessment section). If any sign of compromise is detected, start the incident response process.</li></ol><h3 id=\"mitigation\">Mitigation</h3><p>If patching cannot be applied immediately, F5 provides an iRule-based mitigation for the affected virtual server. To obtain it, F5 BIG-IP clients should contact the F5 support [1].</p><h3 id=\"compromise-assessment\">Compromise Assessment</h3><p>CERT-EU strongly advises to look for the following indicators of compromise provided by the vendor in its advisory [1]:</p><p>At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system.</p><ol><li>OAuth authentication failures: check <code>/var/log/apm</code> for repeated occurrences of the following, especially 10 or more from a single IP in a short window.</li></ol><pre><code>&lt;DATE&gt; &lt;HOST&gt; err tmm1\\[30975\\]: 01990004:3: &lt;PROFILE\\_NAME&gt;: Request UserInfo from Source ID (null) IP &lt;IP&gt; failed. Error Code (invalid\\_token) Error Description (The access token is invalid.)\n</code></pre><ol start=\"2\"><li>Increase of OAuth failure statistics. Run the following and look for an unexplained increase in <code>total_failed</code>:</li></ol><pre><code>$ tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed\n</code></pre><ol start=\"3\"><li><p>Audit log anomalies: if OAuth failures are observed, review <code>/var/log/audit</code> around those timestamps for suspicious commands.</p></li><li><p>TMM core files: Presence of a TMM core file alone is not an indicator, but core files should be investigated. The vendor indicates that they have observed TMM entering a loop, which causes the SOD daemon to send a SIGABRT.</p></li></ol><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://my.f5.com/manage/s/article/K000162605?mkt_tok=NjUzLVNNQy03ODMAAAGkaH9ofwJ_SRrYgVTlugDrbGmtsu1nH57-t7CLkyTTdZHlyphUFNtULl3ACEteoRszBciQ_4gjkNsWTnQqQfftwYMNCzWPXxGhUqTJ-emmdyUmrf_dqfI\">https://my.f5.com/manage/s/article/K000162605?mkt_tok=NjUzLVNNQy03ODMAAAGkaH9ofwJ_SRrYgVTlugDrbGmtsu1nH57-t7CLkyTTdZHlyphUFNtULl3ACEteoRszBciQ_4gjkNsWTnQqQfftwYMNCzWPXxGhUqTJ-emmdyUmrf_dqfI</a> </p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}